Do not expose information via relationfield serializer

Open
#1,634 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
python
Domain
api, authorization, backend, security

Research direction

Start by locating the relationfield serializer that produces relatedItems and trace how it applies the View permission. Reproduce the three-page scenario with one private or inaccessible page, then verify that relatedItems contains only accessible pages and exposes no metadata for inaccessible ones.

Written by the indexing model from the issue text.

Description

Description
The relationfield serializer should respect the View permission.

Problem
Some metadata like, Title and Description can be exposed thru the relationsfield serializer

Reproduce

  1. Create 3 pages
  2. Refer to page 2 and 3 from page 1 via relatedItems
  3. Remove View permission for page 2, or page 3 (You can simply publish page 1 and for example page 2 and keep page 3 private)

Result: bot page 2 and page 3 are serialized in relatedItems

...
    "relatedItems": [
        {
            "@id": "http://localhost:8080/Plone/page-2",
            "@type": "Document",
            "UID": "4f0b980e8a144a55b9244b8b942e93d2",
            "description": "",
            "image_field": null,
            "image_scales": null,
            "review_state": "published",
            "title": "Page 2"
        },
        {
            "@id": "http://localhost:8080/Plone/page-3",
            "@type": "Document",
            "UID": "bec10b954049433088df076e6eb0208d",
            "description": "",
            "image_field": null,
            "image_scales": null,
            "review_state": "private",
            "title": "Page 3"
        }
    ],
...

Expected result
Only list accessible relatedItems and do not expose any metadata information

...
    "relatedItems": [
        {
            "@id": "http://localhost:8080/Plone/page-2",
            "@type": "Document",
            "UID": "4f0b980e8a144a55b9244b8b942e93d2",
            "description": "",
            "image_field": null,
            "image_scales": null,
            "review_state": "published",
            "title": "Page 2"
        }
    ],
...
Dominant language
Python
Stars
109
Forks
107
Avg merge
2d 3h
Merged PRs (30d)
4

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from plone/plone.restapi

All issues in plone/plone.restapi

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.